Configure an intermediate forwarder

Intermediate forwarding is where a forwarder receives data from one or more forwarders and then sends that data on to another indexer. This kind of setup is useful when, for example, you have many hosts in different geographical regions and you want to send data from those forwarders to a central host in that region before forwarding the data to an indexer. All forwarder types can act as an intermediate forwarder.

Configure intermediate forwarding

Set up the intermediate forwarding tier

1. Install the forwarder on your intermediate host.
2. See Configure the forwarder to configure the intermediate forwarder to send data to a receiving indexer if you are using Splunk Enterprise. For Splunk Cloud, see Install and configure the Splunk Cloud Platform universal forwarder credentials package to set up credentials.
   1. If you install the forwarder on Windows, you can specify the receiving indexer during the installation process.
3. Configure the intermediate forwarder to receive data. See Configure a receiver using a configuration file.
4. (Optional) Configure any local data inputs on the intermediate forwarder. See Configure local data inputs.
5. Restart the forwarder services.

You can repeat these steps to add more forwarders to the intermediate tier.

Configure forwarders to use the intermediate forwarding tier

1. Install the universal forwarder.
2. Configure the forwarder to send data to the intermediate forwarder. In this scenario, the intermediate forwarder acts as the receiver.
3. Configure local data inputs on the forwarder.
4. Restart the forwarder services.

Test the configuration

1. In Splunk Web, log into your Splunk deployment.
2. Open the Search and Reporting app.
3. Run a search that contains a reference to one of the hosts that you configured to send data to the intermediate forwarder

   host=<name or ip address of forwarder> index=_internal

   
   If you do not see events, then the host has not been configured properly. See Troubleshoot the universal forwarder for possible fixes.

See also

If you have access to the Edge Processor solution, you can use Edge Processors to fulfill many of the same requirements as an intermediate forwarder tier. For example, you can send data from multiple forwarders in different geographical regions to an Edge Processor that serves as a central host in a specific region, and then send data from that Edge Processor to an indexer. You can also use the Edge Processor to transform the data before routing it to an indexer. For more information, see About the Edge Processor solution in the Use Edge Processors manual.